Ask Your Question

Display filter not showing HTTP packets

asked 2020-03-10 08:46:59 +0000

Hi all,

I have two packets with src port == 8080 and dst port == 6006 (which is x11) and when applying the display filter of 'http' I do not see those packets. Port 8080 is configured for http in the protocol preferences. The packets simply show as tcp. Only if I add port 6006 to http preferences I am able to see the packet when filtering - but that is not a solution for me.

Can anyone help/advise?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-03-10 12:35:27 +0000

Chuckc gravatar image

Can you put a script wrapper around Wireshark and specify the port at startup?

-d <layer type>==<selector>,<decode-as protocol>
Like Wireshark's Decode As... feature, this lets you specify how a layer type should be dissected. If the layer type in question (for example, tcp.port or udp.port for a TCP or UDP port number) has the specified selector value, packets should be dissected as the specified protocol.

Example: -d tcp.port==8888,http will decode any traffic running over TCP port 8888 as HTTP.

See the tshark(1) manual page for more examples.
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-03-10 08:46:59 +0000

Seen: 64 times

Last updated: Mar 10